Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
11634 commits 386 branches 195 tags 257 MiB
Commit graph

61 commits

Author SHA1 Message Date
Jon Siwek
b8c98b8bf7 FileAnalysis: change terminology s/action/analyzer 2013-04-11 14:53:54 -05:00
Jon Siwek
a2d9b47bcd FileAnalysis: finish switching hooks to events. 2013-04-10 11:13:43 -05:00
Jon Siwek
641154f8e8 FileAnalysis: checkpoint in middle of big reorganization. 
- FileAnalysis::Info is now just a record used for logging, the fa_file
  record type is defined in init-bare.bro as the analogue to a
  connection record.

- Starting to transfer policy hook triggers and analyzer results to
  events.
 2013-04-09 15:49:58 -05:00
Jon Siwek
497496ec83 FileAnalysis: replace script-layer SMTP file analysis. 
Notable differences:

- Removed SMTP::MD5 notice.

- Removed ability to specify mime entity excerpt length per mime-type.
 2013-03-26 15:48:52 -05:00
Robin Sommer
edf6750e3d Fixing tests after intel merge. 2012-11-05 16:25:59 -08:00
Seth Hall
172a6345b8 Extracting URLs from message bodies over SMTP and sending them to Intel framework. 
- New utils package for URLs.

- Two functions in the URLs utils.  find_all_urls and
  find_all_urls_without_scheme.
 2012-10-31 08:46:40 -04:00
Seth Hall
38468f9daa Lots more intelligence checking in SMTP traffic. 2012-09-28 22:43:36 -04:00
Seth Hall
375769f42c Added intelligence check for "Received" path checking and a bit of reshuffling. 2012-09-28 22:07:40 -04:00
Seth Hall
0bcedcd204 Restructuring the scripts that feed data into the intel framework slightly. 2012-09-28 13:25:37 -04:00
Seth Hall
2366b21787 One test for cluster transparency of the intel framework. 2012-09-28 13:25:06 -04:00
Seth Hall
a803cae92e Intelligence framework checkpoint 
- Basic API seems to works, but tests aren't updated yet.

 - Several scripts are available in policy/frameworks/intel that
   call the "seen" function to provide data into the intel
   framework to be tested.

 - Intel::policy is not done yet and needs to be discussed to
   figure out what it needs to have.

 - Running the intel framework and having it do something finally
   is really cool!
 2012-09-28 07:07:02 -04:00